diff --git a/machines/vault01/networking.nix b/machines/vault01/networking.nix
index 3d8289a..661dcb4 100644
--- a/machines/vault01/networking.nix
+++ b/machines/vault01/networking.nix
@@ -35,6 +35,21 @@ let
       vlanConfig.Id = Id;
     };
 
+  mkUserVlan =
+    id:
+    let
+      vlan = 3245 + id;
+      prefix24nb = id / 32;
+      prefix29nb = (id - prefix24nb * 32) * 8;
+    in
+    {
+      name = "vlan-user-${builtins.toString vlan}";
+      value = {
+        Id = vlan;
+        address = [ "10.0.${builtins.toString prefix24nb}.${builtins.toString (prefix29nb + 1)}/29" ];
+      };
+    };
+
   vlans = {
     vlan-uplink-cri = {
       Id = 223;
@@ -67,7 +82,7 @@ let
 
       extraNetwork.networkConfig.DHCPServer = "yes";
     };
-  };
+  } // builtins.listToAttrs (builtins.genList mkUserVlan 300); # 850 when we can
 in
 
 {